Fix checking retcodes with runas on Windows

changelog/59977.fixed.md

@@ -0,0 +1,2 @@
+Fixed an issue on Windows where checking success_retcodes when using the
+runas parameter would fail. Now success_retcodes are checked correctly

salt/modules/cmdmod.py

@@ -458,8 +458,6 @@ def _run(
         if isinstance(cmd, (list, tuple)):
             cmd = " ".join(cmd)
 
-        return win_runas(cmd, runas, password, cwd)
-
     if runas and salt.utils.platform.is_darwin():
         # We need to insert the user simulation into the command itself and not
         # just run it from the environment on macOS as that method doesn't work
@@ -492,7 +490,7 @@ def _run(
         # hang.
         runas = None
 
-    if runas:
+    if runas and not salt.utils.platform.is_windows():
         # Save the original command before munging it
         try:
             pwd.getpwnam(runas)
@@ -513,7 +511,7 @@ def _run(
         else:
             use_sudo = True
 
-    if runas or group:
+    if (runas or group) and not salt.utils.platform.is_windows():
         try:
             # Getting the environment for the runas user
             # Use markers to thwart any stdout noise
@@ -752,6 +750,19 @@ def _run(
 
     if not use_vt:
         # This is where the magic happens
+
+        if runas and salt.utils.platform.is_windows():
+
+            # We can't use TimedProc with runas on Windows
+            if change_windows_codepage:
+                salt.utils.win_chcp.set_codepage_id(windows_codepage)
+
+            ret = win_runas(cmd, runas, password, cwd)
+
+            if change_windows_codepage:
+                salt.utils.win_chcp.set_codepage_id(previous_windows_codepage)
+
+        else:
             try:
                 if change_windows_codepage:
                     salt.utils.win_chcp.set_codepage_id(windows_codepage)
@@ -832,10 +843,11 @@ def _run(
                     err = err.rstrip()
             ret["pid"] = proc.process.pid
             ret["retcode"] = proc.process.returncode
-        if ret["retcode"] in success_retcodes:
-            ret["retcode"] = 0
             ret["stdout"] = out
             ret["stderr"] = err
+
+        if ret["retcode"] in success_retcodes:
+            ret["retcode"] = 0
         if any(
             [stdo in ret["stdout"] for stdo in success_stdout]
             + [stde in ret["stderr"] for stde in success_stderr]

tests/pytests/functional/modules/cmd/test_run_win.py

@@ -0,0 +1,50 @@
+import pytest
+
+pytestmark = [
+    pytest.mark.core_test,
+    pytest.mark.windows_whitelisted,
+]
+
+
+@pytest.fixture(scope="module")
+def account():
+    with pytest.helpers.create_account() as _account:
+        yield _account
+
+
+@pytest.mark.skip_unless_on_windows(reason="Minion is not Windows")
+@pytest.mark.parametrize(
+    "exit_code, return_code, result",
+    [
+        (300, 0, True),
+        (299, 299, False),
+    ],
+)
+def test_windows_script_exitcode(modules, state_tree, exit_code, return_code, result):
+    ret = modules.state.single(
+        "cmd.run", name=f"cmd.exe /c exit {exit_code}", success_retcodes=[2, 44, 300]
+    )
+    assert ret.result is result
+    assert ret.filtered["changes"]["retcode"] == return_code
+
+
+@pytest.mark.skip_unless_on_windows(reason="Minion is not Windows")
+@pytest.mark.parametrize(
+    "exit_code, return_code, result",
+    [
+        (300, 0, True),
+        (299, 299, False),
+    ],
+)
+def test_windows_script_exitcode_runas(
+    modules, state_tree, exit_code, return_code, result, account
+):
+    ret = modules.state.single(
+        "cmd.run",
+        name=f"cmd.exe /c exit {exit_code}",
+        success_retcodes=[2, 44, 300],
+        runas=account.username,
+        password=account.password,
+    )
+    assert ret.result is result
+    assert ret.filtered["changes"]["retcode"] == return_code